Mail::...BMacro(3pm)

💅 Mail::SpamAssassin::Plugin::OLEVBMacro 💅

okay bestie, so this little icon is Mail::SpamAssassin::Plugin::OLEVBMacro — a SpamAssassin plugin (section 3pm of the manual, if we're being official about it) that scans your Office documents for OLE Macros and other shady business. yes, that kind of Office document. the ones your aunt forwards. 🦋

---

✨ NAME ✨

Mail::SpamAssassin::Plugin::OLEVBMacro — scan Office documents for evidence of OLE Macros or other exploits. no cap, that's literally the whole job. 🔥

---

🌸 SYNOPSIS 🌸

here's how you actually switch her on, in your config, exactly like this:

loadplugin Mail::SpamAssassin::Plugin::OLEVBMacro

ifplugin Mail::SpamAssassin::Plugin::OLEVBMacro
  body     OLEMACRO eval:check_olemacro()
  describe OLEMACRO Attachment has an Office Macro

  body     OLEOBJ eval:check_oleobject()
  describe OLEOBJ Attachment has an Ole Object

  body     OLERTF eval:check_olertfobject()
  describe OLERTF Attachment has an Ole Rtf Object

  body     OLEMACRO_MALICE eval:check_olemacro_malice()
  describe OLEMACRO_MALICE Potentially malicious Office Macro

  body     OLEMACRO_ENCRYPTED eval:check_olemacro_encrypted()
  describe OLEMACRO_ENCRYPTED Has an Office doc that is encrypted

  body     OLEMACRO_RENAME eval:check_olemacro_renamed()
  describe OLEMACRO_RENAME Has an Office doc that has been renamed

  body     OLEMACRO_ZIP_PW eval:check_olemacro_zip_password()
  describe OLEMACRO_ZIP_PW Has an Office doc that is password protected in a zip

  body     OLEMACRO_CSV eval:check_olemacro_csv()
  describe OLEMACRO_CSV Malicious csv file that tries to exec cmd.exe detected

  body     OLEMACRO_DOWNLOAD_EXE eval:check_olemacro_download_exe()
  describe OLEMACRO_DOWNLOAD_EXE Malicious code inside the Office doc that tries to download a .exe file detected

  body     OLEMACRO_URI_TARGET eval:check_olemacro_redirect_uri()
  describe OLEMACRO_URI_TARGET Uri inside an Office doc

  body     OLEMACRO_MHTML_TARGET eval:check_olemacro_mhtml_uri()
  describe OLEMACRO_MHTML_TARGET Exploitable mhtml uri inside an Office doc
endif

periodt. copy it, paste it, don't touch the names. 🫶

---

🌈 DESCRIPTION 🌈

This plugin detects OLE Macros or other exploits inside Office documents attached to emails. It can detect documents inside zip files as well as encrypted documents.

the way that it just… peeks inside zips AND encrypted docs?? main character energy fr fr. 👑

---

🧚 REQUIREMENT 🧚

This plugin requires Archive::Zip and IO::String perl modules. no modules, no slay. install them. 😭

---

🎀 USER PREFERENCES 🎀

The following options can be used in both site-wide (local.cf) and user-specific (user_prefs) configuration files to customize how the module handles attached documents.

• olemacro_num_mime (default: 5) — Configure the maximum number of matching MIME parts (attachments) the plugin will scan. basically "how many attachments are we even looking at, bestie".
• olemacro_num_zip (default: 8) — Configure the maximum number of matching files inside the zip to scan. To disable zip scanning, set 0.
• olemacro_zip_depth (default: 2) — Depth to recurse within zip files. it goes deeper. zip in a zip. it's giving inception. 🌀
• olemacro_extended_scan ( 0 | 1 ) (default: 0) — Scan all files for potential office files and/or macros, the olemacro_skip_exts parameter will still be honored. This parameter is off by default, this option is needed only to run eval:check_olemacro_renamed rule. If this is turned on consider adjusting values for olemacro_num_mime and olemacro_num_zip and prepare for more CPU overhead. ⚠️ that CPU overhead is real, she will work harder, so tune your numbers first.
• olemacro_prefer_contentdisposition ( 0 | 1 ) (default: 1) — DEPRECATED: This option is deprecated and will be removed in a future release. 💀 don't get attached.
• olemacro_max_file (default: 1024000) — Limit the amount of bytes that the plugin will decode and scan from the MIME objects (attachments). bytes, not vibes.
• olemacro_exts — Set the case-insensitive regexp used to configure the extensions the plugin targets for macro scanning. default:

(?:doc|docx|dot|pot|ppa|pps|ppt|rtf|sldm|xl|xla|xls|xlsx|xlt|xltx|xslb)$

• olemacro_macro_exts — Set the case-insensitive regexp used to configure the extensions the plugin treats as containing a macro. default:

(?:docm|dotm|ppam|potm|ppst|ppsm|pptm|sldm|xlm|xlam|xlsb|xlsm|xltm|xps)$

• olemacro_skip_exts (default: (?:dotx|potx|ppsx|pptx|sldx)$) — Set the case-insensitive regexp used to configure extensions for the plugin to skip entirely, these should only be guaranteed macro free files. guaranteed, bestie. don't skip stuff you're not sure about. 🙈
• olemacro_skip_ctypes (default: ^(?:text\/)) — Set the case-insensitive regexp used to configure content types for the plugin to skip entirely, these should only be guaranteed macro free.
• olemacro_zips (default: (?:zip)$) — Set the case-insensitive regexp used to configure extensions for the plugin to target as zip files, files listed in configs above are also tested for zip.
• olemacro_download_marker — Set the case-insensitive regexp used to match the script used to download files from the Office document. default:

(?:cmd(?:\.exe)? \/c ms\^h\^ta ht\^tps?:\/\^\/)

ngl, those regexps are doing the most, but that's literally what they default to, so leave them alone unless you know exactly what you're doing. 💅

---

and that's the whole page, bestie — no notes, she ate. this was Mail::...BMacro(3pm) from perl v5.40.1, dated 2026-07-23, part of the User Contributed Perl Documentation. love that for us. 💖✨🌸